SD-WAN as a service is a managed version of software-defined wide area networking: a provider operates the central controller, often the connectivity and sometimes the security functions that join your branches, data centers and cloud. You trade direct control for less operational work, so the contract and the security model matter.
What is SD-WAN in plain terms?
A wide area network connects sites. Traditional designs used private circuits and routers configured one by one. Software-defined WAN separates the central policy, set in a controller, from the devices at each site that carry traffic. You write a rule once, such as "send video calls over the faster link", and the controller applies it everywhere. Links can be mixed: broadband, mobile and private circuits.
NIST SP 800-215 treats the evolving WAN as part of its guide to secure enterprise networks, alongside zero trust network access and cloud service access security. It describes SD-WAN together with secure access service edge style frameworks as ways to provide a set of network and security services.
What does "as a service" change?
In a self-run deployment you buy devices, run the controller and manage changes. In a service model the provider runs the controller, often supplies the devices, monitors links and may bundle security functions such as filtering.
That changes who holds the keys. The controller can change routing and policy on every site. Whoever operates it has broad power over your traffic path.
What are the security questions?
Who can change my policy? Ask for role definitions, multifactor authentication on every console, audit logs of changes, and a way to export them.
How is traffic protected? Site to site tunnels are normally encrypted. Ask what algorithms, how keys are generated and rotated, and who holds them.
Is inspection included, and where does it happen? If traffic is steered through a provider cloud for filtering, find out where that traffic is decrypted, if at all, and what is logged.
What happens when the provider has an outage or a breach? Ask about local failover so sites keep working when the controller is unreachable, and about the provider's incident notification promise.
Can I leave? Ask about configuration export, device ownership and contract exit terms.
What does a constructed comparison look like?
A retailer with 120 small stores compares two paths. Running its own SD-WAN needs two network engineers it does not have. A managed service handles installs and monitoring. The security team writes three requirements: store traffic fails over locally if the controller is down, change logs flow to the retailer's own log store, and administrators from the provider use named accounts with multifactor authentication. A provider that cannot meet those three drops out.
How does it fit with zero trust?
An SD-WAN improves how sites connect. It does not decide who is allowed to use an application. NIST describes zero trust as moving the focus from network location to users, assets and resources. A site-to-site network can be well run and still hand every user at a branch broad access. Pair the WAN design with per-application access rules.
How should you compare costs and service levels?
Compare total effort, not only the monthly line. Ask who handles circuit orders, device replacement and after-hours faults, and what the response times are in writing. Check what is reported to you: link health, policy changes and security events. Ask how upgrades are scheduled, since a controller update that changes behaviour across all sites at once is a risk to plan around. Finally, ask for a reference conversation with a customer of similar size, and test failover during any trial.
How to check or apply this
- List sites, link types and what each site must reach.
- Write your must-have requirements, including local failover and log export.
- Ask each provider to document who can change your policy and how that is logged.
- Request a description of encryption and key handling, and have your own engineer review it.
- Decide where inspection happens and which traffic is exempt.
- Negotiate exit terms before signing, including configuration export.
Quick check
Is SD-WAN the same as a VPN?
No. A VPN encrypts a connection. SD-WAN manages and steers traffic across several links under central policy, and usually uses encrypted tunnels as one part.
Does SD-WAN as a service include security?
Sometimes, as an add-on. Read the service description to see which functions are included and who operates them.
Sources
Last reviewed: 18 October 2026.
